The results are different, because those SPL count something completly different.
Look at the first SPL:
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as "Agents Used" count as "Times Used" by useragent
count counts how many times a unique useragent appeared in searched events and I suppose that is what you want to achieve
...but in the second SPL:
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as "Agents Used"
|stats count("Agents Used") as "Times Used" by "Agents Used"
count counts how many useragents were listed by previous command, because it is piped....
Look at the "Statistics" tab on the screen you attached: It says 2 and the result of SPL for each line is also 2.
Do a simple test and compare:
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as x count by useragent
and
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as x
| stats count(x) by x
Regards
... View more